June 2019 - Microsoft Releases Security Patches
Data notifica: 12 giugno 2019
Descrizione
Microsoft addresses vulnerabilities in its June security bulletin. Trend Micro Deep Security covers the following:
- CVE-2019-0985 - Microsoft Speech API Remote Code Execution Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the improper handling of text-to-speech input in Microsoft Speech API. Attackers looking to exploit this vulnerability must find a way to convince a user to execute a specially crafted file. - CVE-2019-1003 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by the Microsoft Edge Chakra scripting engine. Attackers looking to exploit this vulnerability must find a way to convince a user to visit a specially crafted webpage that contains an exploit to this vulnerability. - CVE-2019-0991 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory in the Chakra scripting engine of Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-0540 - Microsoft Office Security Feature Bypass Vulnerability
Risk Rating: Important
This security bypass vulnerability exists in the non-validation of URLs by Microsoft Office. This handling is corrected by this specific patch. - CVE-2019-1005 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Important
This remote code execution vulnerability exists in the handling of objects in memory by Microsoft browsers. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-1051 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may create a specially crafted webpage that contains an exploit to this vulnerability. - CVE-2019-0993 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may create a specially crafted webpage that contains an exploit to this vulnerability. - CVE-2019-0920 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft browsers. Attackers looking to exploit this vulnerability may gain the same user rights as the currently logged on user. - CVE-2019-1052 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft Edge. Attackers looking to exploit this vulnerability may create a specially crafted website and convince the user to view said website. - CVE-2019-0989 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-1002 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-0992 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-0988 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Internet Explorer. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-1055 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft browsers. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-1023 - Scripting Engine Information Disclosure Vulnerability
Risk Rating: Critical
This information disclosure vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-0990 - Scripting Engine Information Disclosure Vulnerability
Risk Rating: Critical
This information disclosure vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability. - CVE-2019-1024 - Chakra Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This information disclosure vulnerability exists in the handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.
Informazioni esposizione:
Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.
| Vulnerability ID | DPI Rule Number | DPI Rule Name | Release Date | Vulnerability Protection Compatibility |
| CVE-2019-0985 | 1009778 | Microsoft Windows Speech API Remote Code Execution Vulnerability (CVE-2019-0985) | 11-Jun-19 | YES |
| CVE-2019-1003 | 1009790 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1003) | 11-Jun-19 | YES |
| CVE-2019-0943, CVE-2019-0984, CVE-2019-0986, CVE-2019-1017, CVE-2019-1041, CVE-2019-1053, CVE-2019-1064, CVE-2019-1069 | 100779 | Microsoft Windows Multiple Security Vulnerabilities (June-2019) | 11-Jun-19 | YES |
| CVE-2019-0991 | 1009786 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0991) | 11-Jun-19 | YES |
| CVE-2019-0540 | 1009764 | Microsoft Office Security Feature Bypass Vulnerability (CVE-2019-0540) | 11-Jun-19 | YES |
| CVE-2019-1005 | 1009791 | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1005) | 11-Jun-19 | YES |
| CVE-2019-1051 | 1009788 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1051) | 11-Jun-19 | YES |
| CVE-2019-0993 | 1009784 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0993) | 11-Jun-19 | YES |
| CVE-2019-0920 | 1009781 | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-0920) | 11-Jun-19 | YES |
| CVE-2019-1052 | 1009792 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1052) | 11-Jun-19 | YES |
| CVE-2019-0989 | 1009785 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0989) | 11-Jun-19 | YES |
| CVE-2019-1002 | 1009789 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1002) | 11-Jun-19 | YES |
| CVE-2019-0992 | 1009783 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0992) | 11-Jun-19 | YES |
| CVE-2019-0988 | 1009780 | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-0988) | 11-Jun-19 | YES |
| CVE-2019-1055 | 1009793 | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1055) | 11-Jun-19 | YES |
| CVE-2019-1023 | 1009794 | Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2019-1023) | 11-Jun-19 | YES |
| CVE-2019-0990 | 1009782 | Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2019-0990) | 11-Jun-19 | YES |
| CVE-2019-1024 | 1009787 | Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1024) | 11-Jun-19 | YES |